CVE-2023-35166

Published: Jun 20, 2023Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5.

Affected (1)

Products: Xwiki: Xwiki

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Xwiki Xwiki	From 8.1 to 14.10.5

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (6)

https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263#diff-4e3467d2ef3871a68b2f910e67cf84531751b32e0126321be83c0f1ed5d90b29L176-R178

Source: security-advisories@github.com

Patch

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h7cw-44vp-jq7h

Source: security-advisories@github.com

PatchVendor Advisory

https://jira.xwiki.org/browse/XWIKI-20281

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263#diff-4e3467d2ef3871a68b2f910e67cf84531751b32e0126321be83c0f1ed5d90b29L176-R178

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h7cw-44vp-jq7h

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://jira.xwiki.org/browse/XWIKI-20281

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

Timeline

No history available yet.